This newv2.36.1 release brings several security and bug fixes and is the last version supporting legacy Windows 7, 8, 8.1 platforms.

Security patch for RUSTSEC-2024-0437

This release temporarily removes theexperimental Cargo feature from the resultingstatic-web-server binary (but not the Cargo feature itself) to prevent shipping the security vulnerability (RUSTSEC-2024-0437#530) in this release.

Theexperimental Cargo feature (that includes experimental features likemetrics andin-memory cache) will be restored to be part of the binary again in the next release.

End support for unmaintained Windows 7, 8, 8.1 platforms

As we mentioned a year ago (#447), SWS would not continue supporting legacy Windows 7, 8, and 8.1 platforms for so long asMicrosoft stopped support for Windows 7 in 2020 and Rust requiresWindows 10 as the minimum supported platform since1.78.

Today, we announce thatv2.36.1 is the last release supporting such legacy platforms and having Rust1.76.0 as MSRV.
Future releases will bump up the MSRV when convenient and will requireWindows 10 as the minimum supported platform.
However, although we willtry to provide a patch for users wanting to build SWS manually for those legacy platforms in the future, wecannot fully guarantee that SWS will continue building for the aforementioned platforms.

Fixes

• ad4c171 Bugfix/security dependency updates including tokio, httparse, ring, rustls, bytes, serde and other crates. PRUpdate dependencies 24-03-2025 #532.
• 5fbd0c5 CORS: Add missingOrigin to theVary header value when CORS feature is enabled. PRAdd missingOrigin to theVary header value when CORS enabled #534 resolvesVary header should includeOrigin header when cors is enabled #533 reported by@rbozan.

For more details see thev2.36.1 milestone and the full changelogv2.36.0...v2.36.1.